fix(auth): add type guards for cross-site browser request headers and fix test mock headers for loopback auth checks

Author: Xenogents

memanto/app/routes/auth_deps.py

@@ -107,7 +107,7 @@ def _is_loopback_host(host: str | None) -> bool:
 
 def _is_loopback_origin(origin: str | None) -> bool:
     """Return True when a browser Origin points at the local Memanto host."""
-    if not origin:
+    if not origin or not isinstance(origin, str):
         return False
     try:
         parsed = urlsplit(origin)
@@ -120,7 +120,7 @@ def _is_loopback_origin(origin: str | None) -> bool:
 
 def _is_loopback_host_header(host: str | None) -> bool:
     """Return True when an HTTP Host header names a loopback interface."""
-    if not host:
+    if not host or not isinstance(host, str):
         return False
     try:
         hostname = urlsplit(f"//{host}").hostname
@@ -132,10 +132,14 @@ def _is_loopback_host_header(host: str | None) -> bool:
 def _is_cross_site_browser_request(request: Request) -> bool:
     """Detect browser requests that must not inherit loopback trust."""
     origin = request.headers.get("origin")
-    if origin is not None:
+    if origin is not None and isinstance(origin, str):
         return not _is_loopback_origin(origin)
 
-    fetch_site = request.headers.get("sec-fetch-site", "").strip().lower()
+    fetch_site = request.headers.get("sec-fetch-site", "")
+    if isinstance(fetch_site, str):
+        fetch_site = fetch_site.strip().lower()
+    else:
+        fetch_site = ""
     return fetch_site in {"cross-site", "same-site"}
 
 

memanto/app/ui/routes/ui_router.py

@@ -14,7 +14,6 @@
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any
-from memanto.app.routes.auth_deps import _is_cross_site_browser_request
 
 from fastapi import (
     APIRouter,
@@ -29,7 +28,11 @@
 
 from memanto.app.clients.backend import Backend
 from memanto.app.config import settings
-from memanto.app.routes.auth_deps import clear_session_cookie, set_session_cookie
+from memanto.app.routes.auth_deps import (
+    _is_cross_site_browser_request,
+    clear_session_cookie,
+    set_session_cookie,
+)
 from memanto.app.utils.temporal_helpers import utc_date_str
 from memanto.app.utils.validation import validate_safe_id
 from memanto.cli.client.direct_client import DirectClient
@@ -95,8 +98,6 @@ async def _require_local(request: Request) -> None:
             ),
         )
 
-    from memanto.app.routes.auth_deps import _is_cross_site_browser_request
-    
     if _is_cross_site_browser_request(request):
         raise HTTPException(
             status_code=403,

tests/test_api.py

@@ -184,6 +184,7 @@ async def test_cross_site_loopback_cannot_create_agent(self, client):
         response = await client.post(
             "/api/v2/agents",
             headers={
+                "Host": "localhost:8000",
                 "Origin": "https://evil.example",
                 "Sec-Fetch-Site": "cross-site",
             },
@@ -205,7 +206,10 @@ async def test_cross_site_loopback_cannot_activate_agent(
 
         response = await client.post(
             "/api/v2/agents/cross-site-activate/activate",
-            headers={"Sec-Fetch-Site": "cross-site"},
+            headers={
+                "Host": "localhost:8000",
+                "Sec-Fetch-Site": "cross-site",
+            },
         )
 
         assert response.status_code == 401

tests/test_e2e.py

@@ -85,7 +85,7 @@ def isolated_dirs():
 async def http():
     """Fresh async HTTP client pointing at the real app (no mocks)."""
     async with AsyncClient(
-        transport=ASGITransport(app=app), base_url="http://test"
+        transport=ASGITransport(app=app), base_url="http://localhost:8000"
     ) as client:
         yield client
 

tests/test_remaining_ui_auth.py

@@ -139,4 +139,5 @@ def test_require_local_allows_loopback_for_conflict_scans(self):
 
         mock_request = MagicMock()
         mock_request.client.host = "127.0.0.1"
+        mock_request.headers = {}
         asyncio.run(_require_local(mock_request))  # must not raise

tests/test_ui_auth.py

@@ -149,14 +149,14 @@ def test_testclient_host_rejected(self):
 
     def test_loopback_origin_accepted(self):
         """Same-origin UI requests from localhost must be allowed."""
-        from memanto.app.ui.routes.ui_router import _is_loopback_origin
+        from memanto.app.routes.auth_deps import _is_loopback_origin
 
         assert _is_loopback_origin("http://localhost:8000") is True
         assert _is_loopback_origin("http://127.0.0.1:8000") is True
         assert _is_loopback_origin("http://[::1]:8000") is True
 
     def test_remote_origin_rejected(self):
-        from memanto.app.ui.routes.ui_router import _is_loopback_origin
+        from memanto.app.routes.auth_deps import _is_loopback_origin
 
         assert _is_loopback_origin("https://evil.example") is False
 
@@ -166,6 +166,7 @@ def test_require_local_allows_loopback(self):
 
         mock_request = MagicMock()
         mock_request.client.host = "127.0.0.1"
+        mock_request.headers = {}
         asyncio.run(_require_local(mock_request))  # must not raise
 
     def test_require_local_allows_ipv4_mapped_loopback(self):
@@ -174,4 +175,5 @@ def test_require_local_allows_ipv4_mapped_loopback(self):
 
         mock_request = MagicMock()
         mock_request.client.host = "::ffff:127.0.0.1"
+        mock_request.headers = {}
         asyncio.run(_require_local(mock_request))  # must not raise